220-1202
Free CompTIA A+ (Core 2) Practice Test
12 exam-style questions with full explanations — no sign-up. Score yourself, then close your gaps with the full course.
Exam fee ~$2594 exam domainsLevel Beginner2 timed practice tests in the course
✅ Free practice — no sign-up📝 Real exam-style questions💡 Detailed explanations💸 30-day money-back via Udemy
A technician suspects a Windows 11 workstation has malware communicating with an external server. Which command should the technician run to view all active TCP connections along with the process ID (PID) using each connection?
netstat -ano lists all active TCP/UDP connections and listening ports along with the owning process ID, allowing the technician to correlate suspicious connections to a specific process.
A technician has verified that a Windows workstation is infected with malware and confirmed the symptoms. According to CompTIA's malware removal best practice procedure, what is the NEXT step the technician should perform?
The malware removal best practice order is: 1) Investigate and verify malware symptoms, 2) Quarantine infected systems, 3) Disable System Restore in Windows, 4) Remediate infected systems (update anti-malware and scan/remove), 5) Schedule scans and run updates, 6) Enable System Restore and create a restore point, 7) Educate the end user. After verifying symptoms, quarantining the system comes next to prevent further spread.
A technician confirms a workstation has ransomware and has already completed step 1 (investigate and identify symptoms) of the standard malware removal process. Which step should the technician perform NEXT?
The CompTIA-recommended order is: 1) Investigate/identify symptoms, 2) Quarantine the infected system, 3) Disable System Restore, 4) Remediate (update and scan), 5) Schedule scans and run updates, 6) Re-enable System Restore and create a restore point, 7) Educate the end user. Quarantine (disconnect from the network) is step 2 and comes immediately after identification.
A technician plans to install a critical driver update on 50 production workstations during business hours next Monday. According to standard change management procedures, which document MUST be completed and approved BEFORE the technician begins the installation?
Standard change management requires a formal change request approved by a change advisory board (or manager) before implementation, and it must document the purpose, scope of change, risk analysis, plan for change, backout/rollback plan, and end-user acceptance before work begins.
A user needs to store a single 12GB video file on a USB flash drive that will be moved back and forth between a Windows 11 PC and a macOS computer, with both systems needing full read/write access. Which file system should the technician use to format the drive?
exFAT supports individual files larger than 4GB and is natively readable and writable by both Windows and macOS without additional drivers.
An employee receives a phone call from someone claiming to be from the IT help desk. The caller states there is an urgent problem with the employee's account and asks the employee to read back their password over the phone to 'verify' it. Which type of social engineering attack does this describe?
Vishing (voice phishing) is a social engineering attack conducted over a phone call, where the attacker impersonates a trusted entity (like IT support) to trick the victim into revealing sensitive information such as a password.
A user reports a Blue Screen of Death (BSOD) with a stop code referencing a video driver, occurring only since a new graphics card driver was installed yesterday. What should the technician do FIRST to resolve this?
Since the BSOD started immediately after a driver update and references the video driver, the least invasive and most direct fix is booting into Safe Mode (which loads minimal drivers) and rolling back the driver to the previous working version using Device Manager.
An employee's laptop is stolen from their car. The laptop contains unencrypted files with patient health records. Which action should the technician take FIRST according to proper incident response procedures?
Because PHI (protected health information) was potentially exposed, the first step in incident response is to report and document the incident to the compliance/security officer so a formal chain-of-custody investigation and any required regulatory breach notification (e.g., HIPAA) can begin.
A small office with five Windows 11 Pro computers wants centralized user account management, Group Policy enforcement, and a single sign-on experience across all the machines. Which network configuration should be implemented?
A domain uses a central server (domain controller) running Active Directory Domain Services to manage user accounts and enforce Group Policy across all joined computers, providing single sign-on.
A company is deploying a new wireless access point in its corporate office. Employees must authenticate using their individual domain credentials against a centralized authentication server, and the company wants the strongest available wireless encryption standard. Which configuration BEST meets these requirements?
WPA3-Enterprise uses 802.1X authentication with a RADIUS server, allowing individual user authentication with domain credentials, combined with the strongest current wireless encryption (192-bit security suite in enterprise mode), satisfying both the centralized authentication and strongest-encryption requirements.
Task Manager shows one background process consuming a large percentage of disk resources, but the technician needs to see the exact files being read and written by that process in real time to determine the root cause. Which built-in Windows tool should be used?
Resource Monitor provides granular, real-time detail on CPU, memory, disk, and network activity per process, including exactly which files are being read from or written to, making it the correct tool for diagnosing a specific process's disk I/O behavior.
A company wants a backup rotation scheme that keeps daily backups for two weeks, weekly backups for a month, and monthly backups for a year, minimizing the number of tapes needed while maintaining long-term recovery points. Which backup rotation scheme BEST fits this requirement?
Grandfather-Father-Son (GFS) is a tape rotation strategy that maintains daily (son), weekly (father), and monthly (grandfather) backup sets, exactly matching the tiered retention described and minimizing total media used.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →220-1202 exam — quick answers
How much does the 220-1202 exam cost?
The exam fee is approximately $259 and varies by region — confirm current pricing with the certification vendor before you book.
What topics are on the exam?
It covers 4 domains: Operating Systems (28%), Security (28%), Software Troubleshooting (23%), Operational Procedures (21%). The full course has a dedicated chapter, lab and practice-test coverage for each.
Is this practice test really free?
Yes — all questions on this page are free with explanations and no sign-up. The paid Udemy course adds two full-length timed exams, video lessons and hands-on labs.
Will this prepare me for the real exam?
The questions mirror the real exam's style and are mapped to the official domains. This is exam-focused preparation — combine the free test with the full course's timed simulations to gauge your readiness.